I ran pfSense on proxmox for a few years. It was fine, but unnecessarily complicated. I switched to an Intel n6005 mini PC and I’ll never go back. Having a second device meant I was able to get rid of my Dell R720xd and switch to consumer hardware with no internet downtime. It means if something happens and I have to hard reboot my server, I don’t have to worry about my partner getting booted from a video call. Etc. Etc. The mini PC was under $200. It sips power. It’s silent. It’s a no-brainer.
I use Cloudflare and I had to disable their proxy to get Matrix federation to work. No clue if it can work using their tunnel.